CVE-2026-20969

Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User interaction is required for triggering this vulnerability...

CVE-2026-20969

Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User interaction is required for triggering this vulnerability...

Samsung Cloud 安全漏洞

SAMSUNG Cloud is an application from the South Korean company Samsung SAMSUNG. It is used to provide a feature to save and view images. A security vulnerability exists in Samsung Cloud versions prior to 5.6.11, which stems from mishandling of insufficient permissions and could lead to accessing...

PT-2026-2056

Name of the Vulnerable Software and Affected Versions Samsung Cloud versions prior to 5.6.11 Description A flaw exists in Samsung Cloud that involves improper handling of insufficient permissions. This allows local attackers to access specific files in arbitrary paths. Recommendations Update...

CVE-2026-22257

CVE-2026-22257 (Salvo) : The Rust web framework Salvo is vulnerable prior to 0.88.1 due to the list_html function in the serve-static directory not sanitizing file/folder names when generating a folder view. This can enable stored cross-site scripting (XSS) when a site serves public files and use...

N8n < 1.121.0 Remote Code Execution (Ni8mare)

According to its banner, the version of n8n running on the remote host is before 1.121.0. It is, therefore, affected by an unauthentcated file access vulnerability which can leads to remote code execution. Note that the scanner has not tested for these issues but has instead relied only on the...

PT-2026-1802

Name of the Vulnerable Software and Affected Versions Asseco ADMX versions prior to 6.09.01.62 Description The Asseco ADMX system, used for processing medical records, allows authenticated users to access medical files belonging to other users. This is achieved by manipulating GET arguments...

n8n 输入验证错误漏洞

n8n is a scalable workflow automation tool from the n8n open source. An input validation error vulnerability exists in versions prior to n8n 1.121.0, which stems from an attacker being able to access underlying server files by executing a form-based workflow, potentially leading to the disclosure...

Asseco AMDX 安全漏洞

Asseco AMDX is an administrative template software from Asseco Poland. A security vulnerability exists in Asseco AMDX versions prior to version 6.09.01.62, which stems from improper manipulation of the GET parameter and could lead to unauthorized access to medical files...

CVE-2025-66916

The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing...

CVE-2026-21858 n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

CVE-2026-21858 n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

CVE-2026-21858 n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

CVE-2026-21858

CVE-2026-21858 (n8n) affects n8n versions starting from 1.65.0 up to and including 1.120.x. The root cause is an inadequate input validation in form-based workflow processing, leading to Content-Type confusion that enables an unauthenticated attacker to read arbitrary server files and potentially...

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

Impact A vulnerability in n8n allows an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker. This could result in exposure of sensitive information stored on the system...

Improper Validation of Specified Type of Input

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input that is passed to the handleFormData function. An attacker can gain unauthorized access to files on the underlying server by requests with unexpected...

Directory Traversal

Overview fast-filesystem-mcp is a Fast Filesystem MCP Server - Advanced file operations with Auto-Chunking, Sequential Reading, complex file operations copy, move, delete, batch, compress, optimized for Claude Desktop Affected versions of this package are vulnerable to Directory Traversal via the...

CVE-2025-67366

@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "readcontent" tool. This vulnerability arises from improper symlink handling in the path validation mechanism...

Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control

Cybersecurity researchers have disclosed details of yet another maximum-severity security flaw in n8n, a popular workflow automation platform, that allows an unauthenticated remote attacker to gain complete control over susceptible instances. The vulnerability, tracked as CVE-2026-21858 CVSS scor...

CVE-2025-46256 WordPress Advanced Database Cleaner PRO Plugin <= 3.2.10 - Limited .txt Path Traversal vulnerability

Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO: from n/a through 3.2.10...